Department of Veterans Affairs 
Washington DC 20420 



May 30, 2019 


In Reply Refer To: 001B 

FOIA Request: 19-07249-F 


Austin Evers & Dan McGrath 
American Oversight 
1030 15‘^ Street NW, Suite B255 
Washington, DC 20005 

FOIA@americanoversiqht.orq : daniel.mcqrath@americanoversiqht.orq 
Dear Mr. Evers and McGrath: 

This is the Initial Agency Decision (lAD) to your Freedom of Information Act (FOIA) request to 
the Office of the Secretary, U.S. Department of Veterans Affairs (OSVA), dated and received 
May 1,2019, and assigned FOIA tracking number 19-07249-F. You requested: 

“All WhatsApp messages sent or received between (1) the VA officials specified below and (2) White 
House adviser Jared Kushner. Screenshots of WhatsApp messages with Kushner are considered 
responsive to this request. 

1. Former Secretary David Shulkin 

ii. Former Chief Information Officer Scott Blackburn 

iii. Former Chief of Staff Peter O’Rourke.” 

As a reminder, on May 21,2019, for your FOIA request 19-07250-F, the VA OIT FOIA office 
issued you a “no records” response and explained, “OIT&T consulted with Information 
Technology Operations and Services (ITOPS) who indicated they do not pull records from 
WhatsApp, because it is an external application and VA does not monitor.” 

lAD & Reasonable Searches Dated 5/29/19 & 5/30/19 

On May 29, 2019, and May 30, 2019, in addition to consulting with ITOPS, the OSVA FOIA 
Officer conducted research as to whether OSVA would retain WhatsApp messages within VA 
Systems of Records. The OSVA FOIA Officer also researched VA Deputy Secretary’s January 

2, 2018, Memorandum titled, “Proper Use of Email and Other Messaging Services.” 

Paragraph 7 of that January 2, 2018, Memorandum says, “Short Message Service (SMS) 
messages, also known are text messages, .. . are not retained on any VA system. Rather, the 
information resides with the service provider, such as Verizon or AT&T, on their networks and 
on the mobile device in the user’s possession.” 

Additionally, when OSVA employees leave the VA, as standard protocol, the OSVA Equipment 
Manager or the VA OIT office returns the contracted mobile phones back to the VA contractor. 
As OSVA does not retain WhatsApp messages or the mobile phones of former OSVA 
employees, OSVA issues you a “no records” response. 

FOIA obligates federal agencies to process records within their Systems of Records, not create 
records or Systems of Records that federal agencies do not already have. LaRoche v. SEC . 
289 F. App'x 231,231 (9th Cir. 2008) (explaining that agency was not required to create new 
documents to satisfy FOIA request); Poll v. U.S. Office of Special Counsel , No. 99-4021,2000 
WL 14422, at *5 n.2 (10th Cir. Jan. 10, 2000) (recognizing that FOIA does not require agency 
'"to create documents or opinions in response to an individual's request for information'" 
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(quoting Hudgins v. IRS , 620 F. Supp. 19, 21 (D.D.C. 1985))); Sorrells v. United States . No. 97- 
5586, 1998 WL 58080, at *1 (6th Cir. Feb. 6, 1998) (advising that agency is not required to 
compile document that "contain[s] a full, legible signature"); Krohn v. DOJ . 628 F.2d 195, 197- 
98 (D.C. Cir. 1980) (finding that agency "cannot be compelled to create the [intermediary 
records] necessary to produce" information sought); Citizen’s Guide on Using FOIA, U.S. House 
Oversight & Gov’t Reform Comm. §V.B, pp. 6 (Sept. 2012), https://oversiqht.house.qov/wp- 
content/uploads/2012/09/Citizens-Guide-on-Usinq-FOIA.2012.pdf (“Please be advised an 
agency is not obligated to create a new record to comply with a request”). 

FOIA Mediation 

As part of the 2007 FOIA amendments, the Office of Government Information Services (OGIS) 
was created to offer mediation services to resolve disputes between FOIA requesters and 
Federal agencies as a non-exclusive alternative to litigation. Using OGIS services does not 
affect your right to pursue litigation. Under the provisions of the FOIA Improvement Act of 2016, 
the following contact information is provided to assist FOIA requesters in resolving disputes: 

VA Central Office FOIA Public Liaison: 

Name: John Buck 

Email Address: vacofoiaservice@va.qov 

Office of Government Information Services (OGIS) 

Email Address: oqis@nara.qov 
Fax: 202-741-5769 
Mailing address: 

National Archives and Records Administration 

8601 Adelphi Road 

College Park, MD 20740-6001 

FOIA Appeal 

This concludes OSVA’s Initial Agency Decision to request 19-07249-F. Please be advised that 
should you desire to do so, you may appeal the determination made in this response to: 

Office of General Counsel (024) 

Department of Veterans Affairs 
810 Vermont Avenue, NW 
Washington, DC 20420 

If you should choose to file an appeal, please include a copy of this letter with your written 
appeal and clearly indicate the basis for your disagreement with the determination set forth in 
this response. Please be advised that in accordance with VA’s implementing FOIA regulations 
at 38 C.F.R. § 1.559, your appeal must be postmarked no later than ninety (90) days of the date 
of this letter. 

Sincerely, 

Richard Ha, JD, CIPP/G 
OSVA FOIA Officer 

Attachment - January 2, 2018, Memo: “Proper Use of Email and Other Messaging Services” 











Department of 
Veterans Affairs 


Memorandum 


Date: JAN ' 2 2018 
From: Deputy Secretary (001) 

Subj: Proper Use of Email and Other Messaging Services 

To: Under Secretaries, Assistant Secretaries, and Other Key Officials 

1. This memorandum and its attachment supersede the attached memorandum 
dated April 24, 2015, and are intended to advise all VA personnel, including 
employees, contractors, trainees, and volunteers, that the use of non-official accounts 
or devices to conduct official agency business is prohibited. 

2. VA records, including those generated by electronic communications, must remain 
within a secure VA Information system, be managed in accordance with the applicable 
records management requirements, and employ, if appropriate, VA-approved 
encryption. Records are defined by the Federal Records Act as “all recorded 
information ... made or received by a Federal agency... in connection with the 
transaction of public business and appropriate for preservation by that agency... as 
evidence of the organization, functions, policies, decisions, procedures, operations, or 
other activities of the ... Government or because of the informational value of the 
data in them.” 44 United States Code § 3301(a)(1)(A). 

3. To ensure proper presentation of records generated by email, VA users conducting 
agency business must use, whenever feasible, official email accounts, such as an 
email address with ©va.gov as the domain name. VA users may not conduct agency 
business through the use of non-official email accounts, such as Gmail or Yahoo. If, 
however, circumstances make use of a non-official email account unavoidable, the 
user must: 

a. Copy the user’s official email address so that the message is sent 
simultaneously to the official account at the moment of transmission; or 

b. Forward a complete copy of the message to the user’s offioial email address 
within 20 days of the original transmission. 

4. Contractors conducting VA business who are assigned VA email accounts will use 
those accounts to transmit emails that meet the definition of a Federal Record 
(“record emails”). If a contractor is unable to use the VA email account due to 
technical constraints, the corporate email account may be used if at least one of the 
following requirements is met: 

a. The record emails contain no Controlled Unclassified Information or other VA 
sensitive information, or are protected by encryption compliant with the 
standards established by the National Institute of Standards and 
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Technology (NIST) in Federal Information Processing Standards Publication 
140-2, Security Requirements for Cryptographic Modules; or 

b. The contractor has implemented basic safeguards as outlined in 48 Code of 
Federal Regulations (C.F.R.) § 52.204-21 and the recommended security 
requirements in NIST Special Publication (SP) 800-171, Protecting Controlled 
Unclassified Information in Nonfederal Information Systems and 
Organizations. 

5. If any record emails are transmitted using a corporate email account, the 
contractor must also comply with all applicable records management laws, including 
National Archives and Records Administration (NARA) regulations and VA policies 
and procedures. As such, the contractor must copy any record email to a VA email 
system or VA record-keeping system within 20 days by simultaneously sending a copy 
to a VA email account or forwarding the message to a VA email account within that 
time frame. To ensure contractor compliance, VA shall insert the clause at 48 C.F.R. 

§ 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, and 
appropriate records management language in solicitations and contracts. 

6. Instant messages (IM) sent or received by VA personnel using Microsoft Lync or 
Skype for Business are generally retained in a VA system. For many VA users, I Ms 
are not retained beyond the conclusion of the conversation. Since information 
transmitted by IM may not be properly preserved, VA personnel should not use IMs to 
conduct communications that are likely to generate VA records. To the extent that 
record material is created using IM, the content must be copied to a recordkeeping 
system to ensure proper preservation. 

7. Short Message Service (SMS) messages, also known as text messages, sent or 
received by VA personnel using a iPhone, Blackberry, or other mobile device, whether 
VA-issued or personally owned, are not retained on any VA system. Rather, the 
information resides with the service provider, such as Verizon or AT&T, on their 
networks and on the mobile device in the user’s possession. Since the information 
transmitted by SMS is arguably outside VA custody, VA personnel should not use 
SMS to conduct communications that are likely to generate record material. To the 
extent that VA records are created using SMS, the content must be copied to a 
recordkeeping system to ensure proper preservation. 
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8. Attached is guidance to be distributed to the appropriate personnel in your 
Administration or Staff Office so that you may make them aware of these 
requirements. Gi-Hyun An is available at (202) 461-7684 to address any questions 
concerning this memorandum. 



Thomas G. Bowman 


Attachment 
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Date: 

Ffom: 

Suti 

To: 


Department of 

Veterans Affairs 
APR 2 4 2015 


Memorandum 


Executive in Charge and Chief Information Officer, Office of Information and 
Technology (005) 


Use of Personal Email (VAIQ #7581492) 

Under Secretaries, Assistant Secretaries, and Other Key Officials 


1. This memo reminds all VA staff and contractors that the use of a personal 
email account or the use of a personal email system to conduct official 
agency business is not allowed. Please distribute this memo, as appropriate, 
through your channels. Official agency email records are to remain within a 
secure VA email system and use appropriate VA-approved encryption, when 
applicable. If there are questions about what constitutes a record, please 
work with your designated records management officials. 

2. VA employees, contractors, volunteers, trainees or anyone with a valid VA 
email address are required to take the annual mandatory Privacy and 
Security Awareness training and subsequently sign the appropriate VA 
National Rules of Behavior or the VA Contractor Rules of Behavior. This 
mandatory training provides guidance indicating that employees/contractors 
should never conduct VA business through personal emails, personal IMs, or 
personal phone text messages and to not use personal email addresses to 
communicate about VA business. 

3. In situations where personal email was utilized, The Presidential and 
Federal Records Act Amendments of 2014, Public Law 113-187, directs that 
any officer or employee of an executive level agency may not create or send 
an email message using a non-government official electronic email system 
unless either of the following conditions are met: (a) the email is immediately 
sent to another official government email account or; (b) the complete copy of 
the email is forwarded to a government email account within 20 days of the 
original creation or transmission of the email record. The intentional violation 
of this act shall be a basis for disciplinary action. 
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4. If you have any questions, feel free to call me at (202) 461-6910 or have a 
member of your staff contact John Oswalt, Senior Agency Official for 
Records, at (202) 632-7489. 



Deputy Assistant Secretary Information Security (005R) 

Deputy Assistant Secretary, Information Technology Resource Management 
(005F) 

Deputy Chief Information Officer, Architecture, Strategy, and Design (005E) 
Acting Executive Director, Office of Enterprise Communications (005EC) 
Deputy Chief Information Officer, Product Development (005Q) 

Deputy Chief Information Officer, Service, Delivery and Engineering (005OP) 
Executive Director for Quality, Performance and Oversight (005X) 

Executive Director for VLER Enterprise PMO (005C) 

Deputy Director for Interagency Program Office (005J) 

Advocate for Health (005A) 

Advocate for Benefits (005A) 

Advocate for Corporate Customers (005A) 


VA-19-0568-A-000005 



